The authentication context class reference.

The time when the end-user was authenticated.

The claims of the end-user (= pieces of information about the end-user) in JSON format.

The authorization server implementation is required to retrieve claims of the subject (= information about the end-user) from its database and format them in JSON format.

For example, if given_name claim, family_name claim and email claim are requested, the authorization server implementation should generate a JSON object like the following and set this claims property to its string representation.

{
  "given_name": "Takahiko",
  "family_name": "Kawasaki",
  "email": "takahiko.kawasaki@example.com"
}

For more details, see OpenID Connect Core 1.0, 5.1. Standard Claims.

Extra properties to associate with an access token and/or an authorization code.

Scopes to associate with an access token and/or an authorization code. If this field is unset, the scopes specified in the original authorization request from the client application are used. In other cases, including the case of an empty array, the scopes here will replace the original scopes contained in the original request.

The value of the sub claim in an ID token. When this field is empty, subject is used.

The subject (end-user) managed by the service.

The ticket issued by Authlete /auth/authorization endpoint.